Posted
by
timothyon Tuesday May 27, 2014 @08:46AM
from the beware-the-jabberwock-my-son dept.

DavidGilbert99 (2607235) writes "Multiple iPhone/iPad/Mac users in Australia are reporting their devices being remotely locked and a ransom demand being made to get them unlocked again. However, unlike PC ransomware, the vector of attack here seems to be Apple's iCloud service with the attacker getting to a database of username/password credentials associated with the accounts. It is unclear if the database was one of Apple's or the hacker is simply using the fact that people reuse the same password for multiple accounts and is using data stolen from another source. Apple is yet to respond, but there has already been one report of the issue affecting a user in the UK."

Where do you get such misinformation? Apple deprecated the use of OpenSSL [appleinsider.com] when it deprecated CDSA back in 2011 for OS X in favor of Common Crypto. At the time there was some mumblings about how Apple didn't like standards. And Apple has never used OpenSSL in iOS.

. . . although OS X provides OpenSSL libraries, the OpenSSL libraries in OS X are deprecated, and OpenSSL has never been provided as part of iOS.

How does this have to do with Apple using or not using OpenSSL? Right now the source of the attack is unknown but speculation is that people reuse their username (email) and passwords from other sites that have been compromised. So if someone has a list of yahoo credentials from heartbleed they might be able to take over someone's Apple account regardless if Apple used or did not use OpenSSL.

I think the most important thing here is to not reuse your passwords. Otherwise breaches at one site can spill over into breaches at more important sites (like for your iphone, or your bank). the best thing to do is to have an easy approach to remember, so you end up with passwords like slashdotsucks666 and yahoosucks666.

How does this have to do with Apple using or not using OpenSSL? Right now the source of the attack is unknown but speculation is that people reuse their username (email) and passwords from other sites that have been compromised. So if someone has a list of yahoo credentials from heartbleed they might be able to take over someone's Apple account regardless if Apple used or did not use OpenSSL.

Hell, it could very well be a phishing attack - a couple of months ago I've been getting a ton of "Apple ID confirmation" and other crap email asking you to "verify" your Apple ID with Apple.

It's slowed down or gone now, but that could also very well be the problem. (Yes, those phishes were pretty obvious, but some were quite good).

Heck, I've gotten them in FRENCH, too. That one was interesting. (In Canada, the typical standard is one email in both English and French, but this was French only).

I wouldn't be surprised if this wasn't the result of said phishing attack.

It's not a MITM atack, but rather the hackers are exploiting a vulnerability in iCloud. Then, using the "Find Device" option they block the phone and demand a 100 euro ransom to unlock them, which the user must pay via PayPal. If the user had enabled two-step authentication they could re-gain control of the phone, otherwise they would be forced to pay the ransom. Full article from the Sydney Morning Herald: http://www.smh.com.au/digital-life/consumer-security/australian-apple-idevices-hijacked-held-to-ransom-20140527-zrpbj.html

Wouldn't the FBI/other put a trace on the account and prevent the criminals from withdrawing without revealing themselves, within a day or two?

It is not like the message is: "Leave 10,000 dollars under the bridge, and come alone or your data gets it."

That, and PayPal also says the account doesn't exist. Then again, just because they are smart enough to hack the Apple servers does';t mean they aren't stupid in other ways; or maybe are arrogant enough to feel they are untouchable?

Maybe this was a proof-of-concept hack and they didn't want to take the risks involved in setting up an actual Paypal account they could extract money from until they were sure it worked?

Possibly. Problem is now that they know it works how do they let people know where to pay; plus PayPal is unlikely to allow payment so they need to find another untraceable way to collect cash and notify their victims before Apple does a fix.

If you happen to tap your Apple ID / password in a subway, in a crowded place or under a surveillance camera, and someone can see it, your account is not blocked, it's hijacked... and you know nothing about it! Thanks to iCloud, where is my i* and the like, that someone may see your personal data, where you are at this very moment, and where you go usually etc... As long as he doesn't alter your data, you don't know. It's been a recurring problem with Apple IDs. Google gmail shows a list of recent activity with IP adresses, and warns immediately about suspicious activity, like a connection from a far/different IP. http://www.forbes.com/sites/adriankingsleyhughes/2012/08/04/the-dangerous-side-of-apples-icloud/ [forbes.com].

Apple do have two-factor authentication these days. If you have that enabled, anyone attempting to log on to your account has to have access to one of your devices or one of your fall-back accounts. Frankly, that should be turned on by default.

My new rule of thumb is that anything I don't have protected by two-factor is something I can afford to lose access to. That's not to say that two-factor is a panacea - it's very easy to set it up so it's useless by, for example, giving a less-secure email address as a fall-back - but it's the minimum for anything I care about.

Until it becomes a hassle. Example, I just got a new phone last week and didn't have a chance to update my google authenticator app to the new device. It was a vacation so the computer stayed at home. I ordered tickets online at went to print at the hotel only to realize I couldn't access my gmail account to print. I was still able to goto Will Call to pick up the tickets, but it still meant waiting in line for 15 minutes, something we had hoped to skip by purchasing online.

It is not that easy. For this variant to work, either an ISP operator has to be running an old/vulnerable DNS service, or the attacker has to poison the local network/DNS. The easiest way of all, is being in the same network as the victim, and even so, some newer infra-structure allows you to block intra-client talk, with pretty much invalidates this kind of protocol attacks. Nevertheless, this scheme works IF the victims have their host files in their Windows machines modified by some malware so much more